alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Merge pull request #1223 from smallstep/carl/docker-pwd

Browse source 
Docker: Generate and use independent provisioner and private key passwords
This commit is contained in:
Carl Tashian 2023-01-10 12:34:56 -08:00 committed by GitHub
commit a78ddc7cc5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
docker/Dockerfile.step-ca
View file

@ -7,7 +7,6 @@ RUN apk add --no-cache curl git make
RUN make V=1 download RUN make V=1 download
RUN make V=1 bin/step-ca bin/step-awskms-init bin/step-cloudkms-init RUN make V=1 bin/step-ca bin/step-awskms-init bin/step-cloudkms-init
FROM smallstep/step-cli:latest FROM smallstep/step-cli:latest
COPY --from=builder /src/bin/step-ca /usr/local/bin/step-ca COPY --from=builder /src/bin/step-ca /usr/local/bin/step-ca

16
docker/entrypoint.sh
View file

@ -34,17 +34,24 @@ function generate_password () {
# Initialize a CA if not already initialized # Initialize a CA if not already initialized
function step_ca_init () { function step_ca_init () {
DOCKER_STEPCA_INIT_PROVISIONER_NAME="${DOCKER_STEPCA_INIT_PROVISIONER_NAME:-admin}"
DOCKER_STEPCA_INIT_ADMIN_SUBJECT="${DOCKER_STEPCA_INIT_ADMIN_SUBJECT:-step}"
local -a setup_args=( local -a setup_args=(
--name "${DOCKER_STEPCA_INIT_NAME}" --name "${DOCKER_STEPCA_INIT_NAME}"
--dns "${DOCKER_STEPCA_INIT_DNS_NAMES}" --dns "${DOCKER_STEPCA_INIT_DNS_NAMES}"
--provisioner "${DOCKER_STEPCA_INIT_PROVISIONER_NAME:-admin}" --provisioner "${DOCKER_STEPCA_INIT_PROVISIONER_NAME}"
--password-file "${STEPPATH}/password" --password-file "${STEPPATH}/password"
--provisioner-password-file "${STEPPATH}/provisioner_password"
--admin-subject "${DOCKER_STEPCA_INIT_ADMIN_SUBJECT}"
--address ":9000" --address ":9000"
) )
if [ -n "${DOCKER_STEPCA_INIT_PASSWORD}" ]; then if [ -n "${DOCKER_STEPCA_INIT_PASSWORD}" ]; then
echo "${DOCKER_STEPCA_INIT_PASSWORD}" > "${STEPPATH}/password" echo "${DOCKER_STEPCA_INIT_PASSWORD}" > "${STEPPATH}/password"
echo "${DOCKER_STEPCA_INIT_PASSWORD}" > "${STEPPATH}/provisioner_password"
else else
generate_password > "${STEPPATH}/password" generate_password > "${STEPPATH}/password"
generate_password > "${STEPPATH}/provisioner_password"
fi fi
if [ -n "${DOCKER_STEPCA_INIT_SSH}" ]; then if [ -n "${DOCKER_STEPCA_INIT_SSH}" ]; then
setup_args=("${setup_args[@]}" --ssh) setup_args=("${setup_args[@]}" --ssh)
@ -56,6 +63,13 @@ function step_ca_init () {
setup_args=("${setup_args[@]}" --remote-management) setup_args=("${setup_args[@]}" --remote-management)
fi fi
step ca init "${setup_args[@]}" step ca init "${setup_args[@]}"
echo ""
if [ -n "${DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT}" ]; then
echo "👉 Your CA administrative username is: ${DOCKER_STEPCA_INIT_ADMIN_SUBJECT}"
fi
echo "👉 Your CA administrative password is: $(< $STEPPATH/provisioner_password )"
echo "🤫 This will only be displayed once."
shred -u $STEPPATH/provisioner_password
mv $STEPPATH/password $PWDPATH mv $STEPPATH/password $PWDPATH
} }